<html>
<head><meta charset="utf-8"><title>bincode · t-lang/wg-unsafe-code-guidelines · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/index.html">t-lang/wg-unsafe-code-guidelines</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/bincode.html">bincode</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="156962636"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/bincode/near/156962636" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jethro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/bincode.html#156962636">(Jan 27 2019 at 08:07)</a>:</h4>
<p>is this safe? <a href="https://github.com/TyOverby/bincode/blob/72bb6ef050f065161d476ce2ee0231140eb08d2a/src/de/read.rs#L144-L149" target="_blank" title="https://github.com/TyOverby/bincode/blob/72bb6ef050f065161d476ce2ee0231140eb08d2a/src/de/read.rs#L144-L149">https://github.com/TyOverby/bincode/blob/72bb6ef050f065161d476ce2ee0231140eb08d2a/src/de/read.rs#L144-L149</a></p>



<a name="156968345"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/bincode/near/156968345" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/bincode.html#156968345">(Jan 27 2019 at 11:22)</a>:</h4>
<p>I don't think it is. If <code>self.reader.read_exact</code> doesn't fill the buffer (e.g. there is an I/O error while reading, or it's implemented incorrectly, or it panics for some reason) then this code exposes uninitialized bytes to the world. And while it's still up for debate whether there are <em>some</em> things that can be done in careful unsafe code with uninitialized bytes, it's certain that uninitialized memory can lead to UB when used in unsuspecting safe code.</p>



<a name="156968362"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/bincode/near/156968362" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/bincode.html#156968362">(Jan 27 2019 at 11:23)</a>:</h4>
<p>It also exposes uninitialized memory to the implementation of <code>read_exact</code> so if that reads from the buffer (which it "shouldn't" but safe code can do it) it'll get uninitialized bytes too, with the same consequences.</p>



<a name="156969304"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/bincode/near/156969304" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jethro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/bincode.html#156969304">(Jan 27 2019 at 11:50)</a>:</h4>
<p>yeah I was thinking the same</p>



<a name="156969468"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/bincode/near/156969468" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jethro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/bincode.html#156969468">(Jan 27 2019 at 11:56)</a>:</h4>
<p>I would <em>like</em> it to be the case that passing a slice of uninitialized memory to read, read_exact, etc. is not UB</p>



<a name="156973110"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/bincode/near/156973110" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/bincode.html#156973110">(Jan 27 2019 at 13:54)</a>:</h4>
<p>for this to work with <em>unknown</em> implementations of <code>Read</code>, we'd have to make these functions unsafe</p>



<a name="156975886"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/bincode/near/156975886" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jethro <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/bincode.html#156975886">(Jan 27 2019 at 15:27)</a>:</h4>
<p>Oh yeah I guess you're right. This seems to be a compelling argument for &amp;uninit</p>



<a name="156975995"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/bincode/near/156975995" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/bincode.html#156975995">(Jan 27 2019 at 15:30)</a>:</h4>
<p>What is usually done is <code>set_len</code> <em>after</em> you know the length.</p>



<a name="156976000"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/bincode/near/156976000" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/bincode.html#156976000">(Jan 27 2019 at 15:31)</a>:</h4>
<p>but then you need to figure out how to get yourself the buffer before set_len is made <span aria-label="slight smile" class="emoji emoji-1f642" role="img" title="slight smile">:slight_smile:</span></p>



<a name="156981245"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/bincode/near/156981245" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/bincode.html#156981245">(Jan 27 2019 at 18:03)</a>:</h4>
<blockquote>
<p>Oh yeah I guess you're right. This seems to be a compelling argument for &amp;uninit</p>
</blockquote>
<p>an alternative might be to use <code>&amp;mut [MaybeUninit&lt;u8&gt;]</code></p>



<a name="156981254"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/bincode/near/156981254" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/bincode.html#156981254">(Jan 27 2019 at 18:03)</a>:</h4>
<p>that doesn't encode that the data will be initialized, but it also doesn't require an all-new reference type</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>